Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe
Resource
win7-20220812-en
General
-
Target
a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe
-
Size
144KB
-
MD5
19e0e8ac9b12a73462419a205f63fe21
-
SHA1
223b5e205b2794df4406a6f706408b2570f62477
-
SHA256
a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9
-
SHA512
8026e25f24eaa0f82f6e31b822ad571cb846eaaf8d885ebce45276470486b07b79eb1a7780db5ce6900525eea1c6548aad401cf65f9ca09aee3e7f509847c82d
-
SSDEEP
3072:5VK1M+IRHl+BSVIKISNq+Ha29M9U5EGzGv48YfIqRDUcEuccxB:5sC+wHlCSQSNqea29M9Udk4wqRDCxc/
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1632-58-0x0000000000400000-0x0000000000427000-memory.dmp family_gh0strat behavioral1/files/0x000a000000014142-62.dat family_gh0strat behavioral1/memory/1632-63-0x0000000000530000-0x000000000055B000-memory.dmp family_gh0strat behavioral1/files/0x000a000000014142-65.dat family_gh0strat behavioral1/files/0x00140000000054ab-68.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1552 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1552 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Vlal\Waojxeqoi.gif a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe File created C:\Program Files (x86)\Vlal\Waojxeqoi.gif a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe 1552 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeRestorePrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeBackupPrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeRestorePrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeBackupPrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeRestorePrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeBackupPrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe Token: SeRestorePrivilege 1632 a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe"C:\Users\Admin\AppData\Local\Temp\a8edb7042563ce6592ed2c5a23dcf8081f90a10d0d5ccb97c3e3bae46d1179a9.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1552
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD59a321afedb20299237990eab5f04438a
SHA1cfa0ee092174d53d23b80d4c08f1b122958c50f1
SHA256ea4c6fc4b5fe10c83af82d5104d5a9b8c528fd383cce4677c0d10c708732c3bb
SHA512dd63b78f80897bd585721694f7392daa10550a66b0d3d71371f86aaebec948d09b23a5db8044b0d5c39a119b6cf5e28b77bd23af9f129da6693021673d2de23b
-
Filesize
117B
MD5797622209772cab27184be02d926d1c6
SHA1d940519a47b18d3924aef95608ff9b1037f4854e
SHA25614ac8fa5b717a9cc3e115178841fd306f439c36d27b496531eaab98a13256988
SHA512a67096f169bc3dc720807e2ddf0a8ad373212b25a764ef2ec065c505643fb763973ea348d16ba3b52ba8884d3cf803b494fd4017029cc3dc65db3e299ec70a52
-
Filesize
14.2MB
MD5b8d8ac622f5d28e17cdacfaaa15cf0ec
SHA12cdec858492b54d456d4a8a1dcdae25f0bb028d9
SHA25644ece24262558bacedba8a56204bb9671fc903d5a16208d25d2aa1623ac03118
SHA51225fbb311ef5a92b6ccbf22afb846e9b5b936d4a18df690485561685e55263aeace08f13185263bf68c6bac2be02137b9d1a9e5af7555633fe1b225b4f1521334
-
Filesize
14.2MB
MD5b8d8ac622f5d28e17cdacfaaa15cf0ec
SHA12cdec858492b54d456d4a8a1dcdae25f0bb028d9
SHA25644ece24262558bacedba8a56204bb9671fc903d5a16208d25d2aa1623ac03118
SHA51225fbb311ef5a92b6ccbf22afb846e9b5b936d4a18df690485561685e55263aeace08f13185263bf68c6bac2be02137b9d1a9e5af7555633fe1b225b4f1521334